Stack buffer overflow in FreeSWITCH mod_rtmp AVC sequence-header construction
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
FreeSWITCH before 1.11.2 has a stack-based buffer overflow in mod_rtmp, where rtmp_rtp2rtmpH264() copies SPS and PPS values from the wire into a fixed stack buffer without checking their sizes. A remote attacker bridging an established H.264 call toward an RTMP endpoint can supply oversized parameter sets and overwrite the stack frame, which requires a deployment that builds and loads mod_rtmp and bridges RTP media into an RTMP leg. The overflow can abort FreeSWITCH and end every active call, and builds without stack protection get a limited stack-write primitive, although code execution has not been demonstrated.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack buffer by copying wire-derived SPS and PPS values without checking that their sizes and framing fit. An established H.264 call bridged toward an RTMP endpoint could supply oversized SPS and PPS parameter sets and overrun the function's stack frame. The flaw affects only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg; the module is disabled in the stock build and configuration. The corruption can abort FreeSWITCH and terminate every active call, and builds without stack protection receive a limited stack-write primitive, although code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| signalwire | freeswitch | before 1.11.2 | 1.11.2 | Patch available | CNA |
- freeswitch Vendorsignalwire Affected before 1.11.2 Fixed in 1.11.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* | — | — | freeswitch |
- cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* Versions — — ·freeswitch
Remediation
Upgrade signalwire FreeSWITCH to version 1.11.2 or later, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA freeswitch (signalwire) Fixed in 1.11.2
Timeline
- 2026-11-05 Threatist record created from CVE-2026-116571
- 2026-11-07 Priority changed: MEDIUM → LOW
References
More signalwire vulnerabilities
- TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
- TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
- TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
- TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
- TI-2023-15601 heap-over-flow and integer-overflow in sofia-sip CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences